Understanding data lifetime via whole system simulation

摘要: Strictly limiting the lifetime (i.e. propagation and duration of exposure) sensitive data (e.g. passwords) is an important well accepted practice in secure software development. Unfortunately, there are no current methods available for easily analyzing lifetime, very little information on quality today's with respect to lifetime. We describe a system we have developed through whole simulation called TaintBochs. TaintBochs tracks by "tainting" it at hardware level. Tainting then propagated across operating system, language, application boundaries, permitting analysis handling level. We used analyze several large, real world applications. Among these were Mozilla, Apache, Perl, which process millions passwords, credit card numbers, etc. daily basis. Our investigation reveals that applications components they rely upon take virtually measures limit handle, leaving passwords other scattered throughout user kernel memory. We show how few simple practical changes can greatly reduce